Signal K Server CVE-2026-39320

No special conditions-remote unauthenticated exploitation against default configurations of Signal K Server. The vulnerability exists in the core WebSocket subscription handler, which is enabled by default and requires no authentication for establishing connections or sending subscription requests. The only prerequisite is network accessibility to the Signal K Server WebSocket endpoint (typically port 3000/tcp), which may be exposed intentionally for remote monitoring, accidentally via misconfigured firewalls, or through compromised onboard networks. The attack succeeds regardless of Signal K Server deployment mode (standalone, plugin-based, or integrated with OpenPlotter/Victron systems) and requires no user interaction, no special client software beyond basic WebSocket capability, and no prior knowledge of vessel-specific configurations. The trivial attack complexity (AC:L) reflects that exploitation requires only understanding the WebSocket subscription API format, which is documented in Signal K protocol specifications. No platform-specific constraints exist-the vulnerability affects Signal K Server across all operating systems (Linux, Windows, macOS) where Node.js runs. The single limiting factor for widespread exploitation is the specialized nature of Signal K deployments in marine environments, making targets less discoverable via broad internet scanning compared to general-purpose web applications.

Real-world risk assessment requires balancing multiple signals. The CVSS 7.5 (High) severity reflects maximum availability impact (A:H) with network-accessible, low-complexity, unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N), indicating trivial attack requirements. However, EPSS score of 0.04% (13th percentile) suggests extremely low probability of exploitation in the wild, likely due to Signal K Server's niche deployment in marine environments rather than enterprise IT infrastructure. The vulnerability is NOT listed in CISA KEV, confirming no known active exploitation. GitHub security advisory GHSA-7gcj-phff-2884 provides detailed technical analysis and proof-of-concept details, lowering the barrier for adversaries but still requiring knowledge of Signal K's specialized ecosystem. From an SSVC perspective: exploitation status is 'public' (detailed advisory), automatable is 'yes' (simple network request), technical impact is 'partial' (availability only, no C/I), and mission impact depends entirely on vessel criticality-recreational boats have minimal impact, but commercial vessels or critical maritime infrastructure could face significant operational disruption. Priority should be HIGH for any production marine deployment but LOW for development/test environments. The 100% CPU consumption and complete unresponsiveness distinguish this from partial degradation DoS vulnerabilities. Main limiting factor: attacker must specifically target Signal K installations, which are not discoverable via typical internet scanning unless exposed through port forwarding or cloud deployments.

An attacker identifies a Signal K Server instance exposed to the internet (common in cloud-based fleet management or remote monitoring scenarios) by scanning for default port 3000 or identifying the WebSocket endpoint through banner grabbing. Without authentication, the attacker establishes a WebSocket connection and sends a subscription message with a maliciously crafted context parameter containing regex metacharacters designed for catastrophic backtracking (e.g., nested quantifiers like '(a+)+' or alternation patterns). When the server attempts to match this pattern against its own UUID string or other identifier during subscription filtering, the Node.js event loop enters exponential-time evaluation, consuming 100% CPU and blocking all other operations. The vessel's navigation system becomes completely unresponsive, disrupting real-time sensor data aggregation, chart plotting, autopilot integration, and AIS transponder functionality. The attack requires only basic WebSocket client capabilities (curl, wscat, or any browser console) and knowledge of Signal K's subscription API structure, both publicly documented.